Skip to content

velociraptor: fix label actions (stray quote after FROM scope()) (fixes #459) - #460

Open
chiefghost47 wants to merge 1 commit into
Shuffle:masterfrom
chiefghost47:velociraptor-fix-labels
Open

chiefghost47 wants to merge 1 commit into
Shuffle:masterfrom
chiefghost47:velociraptor-fix-labels

Conversation

@chiefghost47

Copy link
Copy Markdown
Contributor

Problem

add_client_label, get_client_label and remove_client_label never do anything (#459). Each query
ends with a stray single quote after FROM scope():

query = "SELECT label(client_id='" + client_id + "', labels=['" + label  +"'], op='set') FROM scope()'"

Velociraptor does not run the statement: the actions return [], and no label is set, checked or
removed.

Fix

Remove the trailing ' from the three label queries. Nothing else changes.

Testing

Against Velociraptor 0.77.3, calling the app's own methods in an image built with the repo's
Dockerfile:

  • Before: add_client_label returns [] and the label is not on the client.
  • After: add_client_label sets the label ({"ClientId": ..., "Labels": [...], "Op": "set"}),
    get_client_label returns the check result, and remove_client_label removes it. Each step was
    confirmed by reading the client's labels afterwards.

The test image also carried #457 (org_id), so the calls could be run in a non-root org. This change
does not depend on it.

Fixes #459

Shuffle#459)

Remove the trailing single quote that made the three label queries invalid VQL.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

velociraptor: label actions never run (stray quote after FROM scope())

1 participant